CVE-2022-3995: Authorization Bypass Through User-Controlled Key

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

CVE-2022-4028: Improper Neutralization of Input During Web Page Generation

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes...

CVE-2021-25059: Undefined Security Weakness

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site such as subscriber to download a full copy of the website...

CVE-2022-3511: Undefined Security Weakness

The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector...

CVE-2022-45363: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Stored Cross-Site Scripting XSS in Muffingroup Betheme theme = 26.6.1 on WordPress...

CVE-2022-3861: Deserialization of Untrusted Data

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...

CVE-2022-41788: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

CVE-2022-41655: Exposure of Sensitive Information to an Unauthorized Actor

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-41609: Server-Side Request Forgery (SSRF)

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-40216: Improper Access Control

Auth. subscriber+ Messaging Block Bypass vulnerability in Better Messages plugin = 1.9.10.69 on WordPress...

CVE-2022-40130: Concurrent Execution using Shared Resource with Improper Synchronization

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-40698: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

PT-2022-25479

Name of the Vulnerable Software and Affected Versions Quiz And Survey Master plugin versions = 7.3.10 Description The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has subscriber-level access or higher can inject malicious scripts int...

CVE-2022-45369: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...

CVE-2022-45077: Deserialization of Untrusted Data

Auth. subscriber+ PHP Object Injection vulnerability in Betheme theme = 26.5.1.4 on WordPress...

CVE-2022-45066: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin = 2.0.1 on WordPress...

CVE-2022-2450: Missing Authorization

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

CVE-2022-41978: Undefined Security Weakness

Auth. subscriber+ Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin = 1.7.5.8 on WordPress...

CVE-2022-40205: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

CVE-2022-3536: Deserialization of Untrusted Data

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, an...